Create a time series graph after a stats command

[jamesboustead]

Hi,

I'm not able to create a timechart graph for the below search, it is coming up with no result.

My current search is as below:

"My search 

| stats count by xxx

| xxx = xxx * count

| stats sum(xxx) as "yyy"

"

This search gives the the correct total but only relating to the time range picker, how would I manipulate the query to get a time series graph by the sum of each day?

[scelikok · Accepted solution]

Since I don't know your data I tried to convert your search  to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.

| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy

[scelikok]

Hi @jamesboustead,

Since your search has no _time field on group by. "timechart" command use _time field for group by.

Please try below as a sample;

| timechart span=1d count by xxx
| eval xxx = xxx * count
| timechart span=1d sum(xxx) as yyy

If this reply helps you an upvote is appreciated.

[jamesboustead]

This is now giving me two columns:

- one for "_time" which is split up daily which is good.

- one for 'yyy' but unfortunately this has no values underneath the column.

Please can you advise on how to get the value underneath 'yyy' corresponding to each day in the '_time' column?

Thank you

[saravanan90]

We can use timechart command. 

index=_internal
| timechart span=1d count